相关疑难解决方法(0)

首先,根据Spring doc ,如果我想将用户角色映射到范围,我应该使用setCheckUserScopes(true)到DefaultOAuth2RequestFactory.所以这样做的一种方法是注入我自己的DefaultOAuth2RequestFactory bean,正如doc所说:

The AuthorizationServerEndpointsConfigurer allows you to inject a custom OAuth2RequestFactory so you can use that feature to set up a factory if you use @EnableAuthorizationServer.

然后我做

@Configuration
@EnableAuthorizationServer
public class OAuth2AuthorizationServerConfig extends
        AuthorizationServerConfigurerAdapter {

    ...

    @Override
    public void configure(AuthorizationServerEndpointsConfigurer endpoints)
            throws Exception {
        endpoints.authenticationManager(authenticationManager)
                .tokenStore(tokenStore)
                .tokenServices(tokenServices());

       endpoints
            .getOAuth2RequestFactory(); // this doesn't return me my own DefaultOAuth2RequestFactory 

    }

    @Bean
    @Primary
    public OAuth2RequestFactory defaultOAuth2RequestFactory() {
        DefaultOAuth2RequestFactory defaultOAuth2RequestFactory = new DefaultOAuth2RequestFactory(
                clientDetailsService);
        defaultOAuth2RequestFactory.setCheckUserScopes(true);
        return defaultOAuth2RequestFactory;
    }
}

编辑

我忽略了AuthorizationServerEndpointsConfigurer中的方法requestFactory().这是将它传递给Spring …

我们有一个权利数据库,其中包含应用程序ID,角色和用户映射到每个应用程序的角色.遵循线程建议如何基于resourceId将用户角色映射到oauth2范围/权限？

忽略我上面提到的权利数据库,我是否根据下面代码中的user和resourceId将角色"USER","READER","WRITER"映射到oauth2范围/权限？

用户认证/授权配置

@Configuration
@Order(-10)
protected static class LoginConfig extends WebSecurityConfigurerAdapter {

    ....

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        // auth.parentAuthenticationManager(authenticationManager);
        // @formatter:off
        auth.inMemoryAuthentication()
            .withUser("admin").password("admin")
                .roles("ADMIN", "USER", "READER", "WRITER")
            .and()
            .withUser("user").password("password")
                .roles("USER")
            .and()
            .withUser("audit").password("audit")
                .roles("USER", "ADMIN", "READER");
        // @formatter:on
    }
}

OAuth2配置

@Configuration
@EnableAuthorizationServer
protected static class OAuth2Config extends AuthorizationServerConfigurerAdapter {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Override
    public void configure(ClientDetailsServiceConfigurer clients) throws Exception {
        // @formatter:off
        clients.inMemory()
            .withClient("acme").secret("acmesecret")
                .authorizedGrantTypes("authorization_code", "refresh_token", "password")
                .scopes("openid")
            .and() …

我成功配置了spring-security-oauth2,以便外部应用程序可以使用我的应用程序进行身份验证.但是,基于外部应用程序并基于用户允许的内容,客户端只能访问我的API的一部分.可用子集由OAuth Scopes确定.

在经典的Spring应用程序中,我可以使用@PreAuthorize来强制基于角色的边界:

@Controller
public class MyController {
  @PreAuthorize("hasRole('admin')")
  @RequestMapping("...")
  public String doStuff() {
    // ...
  }
}

使用OAuth和Scopes而不是角色时,我该怎么做？